---
title: "Replace object access control list"
method: PUT
path: "/v1/objects/{object-id}/access-rights"
tags: ["Objects"]
---

# Replace object access control list

`PUT /v1/objects/{object-id}/access-rights`

Replace the object's directly assigned access control list and set the inherited-rights
flag. This is a full replacement: any user or group not present in `accessList` loses its
directly assigned rights on the object. Both members are optional; an omitted member
leaves the current value unchanged. Requires both modify and access-control rights on the
object.

## Path parameters

- `object-id` integer, required

## Request body

- ObjectAccessRights — Object access control list and the flag controlling inheritance of access rights from parent objects.
  - `inheritAccessRights` boolean — When true, effective rights include those inherited from parent objects in addition to the directly assigned rights below.
  - `accessList` object[] — Directly assigned access control entries. On update this is a full replacement of the object's own access list.
    - `userId` integer — User or group ID. Group IDs have the high bit (0x80000000) set.
    - `access` integer — Bit mask of access rights granted to the user or group on this object.

## Response `200`

Access rights updated; the resulting access control list is returned.

- ObjectAccessRights — Object access control list and the flag controlling inheritance of access rights from parent objects.
  - `inheritAccessRights` boolean — When true, effective rights include those inherited from parent objects in addition to the directly assigned rights below.
  - `accessList` object[] — Directly assigned access control entries. On update this is a full replacement of the object's own access list.
    - `userId` integer — User or group ID. Group IDs have the high bit (0x80000000) set.
    - `access` integer — Bit mask of access rights granted to the user or group on this object.

## Other responses

- `400` — Malformed request body or invalid access list
- `401` — Unauthorized
- `403` — User does not have modify and access-control rights on the object
- `404` — Object with given ID does not exist

---

[API](https://skmtc.net/netxms/apis/netxms-api.md) · [All operations](https://skmtc.net/netxms/apis/netxms-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/netxms/netxms-api/versions/ee1f54ee3abd/schema)